`service.name` fields missing in some ECS fields

There appears to be a bit of confusion over where `service.name` is defined in the ECS fields.

For example `filebeat` doesn't define it: https://github.com/elastic/integrations/blob/main/packages/elastic_agent/data_stream/filebeat_logs/fields/ecs.yml

but k8s does: https://github.com/elastic/integrations/blob/main/packages/kubernetes/data_stream/container_logs/fields/ecs.yml#L25-L26

This results in filters like `NOT service.name: "filebeat"` generally returning bad results, as any datastreams that don't define `service.name` will ignore the filter.

Are we just missing `service.name` from a few datastreams? Do we need to normalize a bunch of the ECS fields in the log datastreams?